If your Content Security Policy doesn’t allowlist Invoca’s script and connection sources, the Tag will silently fail to load — here’s how to confirm it and fix it.
Symptoms
The Tag is deployed via Google Tag Manager but doesn’t load on the website. The Chrome DevTools console shows an error similar to: “Refused to load the script https://solutions.invocacdn.com/js/invoca-latest.min.js…”Cause
A Content Security Policy (CSP) protects web applications from attacks like cross-site scripting or data injection by letting developers define which resources can load and execute. This can unintentionally block the Invoca Tag if its script source isn’t included in the policy.Resolution
Confirm the cause: Install the Chrome extension “Disable Content Security Policy” from the Chrome Web Store, enable it, then revisit the site. If the Tag loads successfully with the extension enabled, the issue is your CSP. Fix it: Add the Invoca script source to your CSP allowlist.- For US accounts:
solutions.invocacdn.com(Invoca Tag script),pnapi.invoca.net(number swap request) - For EU accounts:
solutions.eu.invocacdn.com(Invoca Tag script),pnapi.eu.invoca.net(number swap request)
<meta> tag in your HTML:
'self', solutions.invocacdn.com, and pnapi.invoca.net) to load.